Localhost-Detect

An authenticated API user with XCom write-and-read access can instantiate arbitrary `airflow.*` classes on the API server. This occurs because the `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passes a string-literal payload through the `BaseXCom.deserialize value()` function without the ` check forbidden xcom keys` guard. The issue is triggered when a user writes an XCom value and subsequently reads it back with the `deserialize` parameter set to `true`. This is a deserialization flaw, where untrusted data is used to abuse the logic of an application to execute unintended code or instantiate unauthorized objects.

LangChain contains runtime code paths that deserialize inputs, outputs, or other application-controlled payloads using overly broad object allowlists, specifically calling `load()` with `allowed objects="all"`. This allows attacker-supplied serialized constructor dictionaries to instantiate trusted classes with untrusted arguments. This issue can lead to Server-Side Request Forgery (SSRF), enabling access to internal services, cloud metadata endpoints, or sensitive network resources, which may result in credential theft and persistent supply-chain compromise. Applications are exposed if they accept untrusted structured input (such as JSON) without validation, preserve attacker-controlled nested dictionaries or lists in run data, and use affected API paths. Known affected surfaces include the `RunnableWithMessageHistory` class, the `astream log()` function, and the `astream events(version="v1")` function. Additionally, a secret-marker validation bypass in the ` is lc secret` function allows constructor dictionaries to avoid escaping during `dumps()` to `loads()` round-trips.